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Logs any identified TOR routers used for 
anonymizing internet traffic 

Searchable fields 

■ TOR from server 
TOR to server 

■ Router nickname 
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XKS goal is to store the full-take 
content for 3-5 days, effectively 
"slowing down the Internet" so that 
analysts can go back and recover 
sessions that otherwise would have 
been dropped by the front end 

Meta-data is saved off longer, with the 
goal of 30 days retention 

A lot of analysis can be done through 
meta-data oniy (MARINA is meta-data 
only) 
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XKS gives analysts unique access to 
terabytes of content and meta-data 

Typically sites select and forward to 
PINWALE less than 5% of the DNI 
they're processing 




• The rest of that data used to be dropped 
but is now being retained temporarily 
and made available to analysts through 
X-KEYSCORE 



• As an example, at one our sites XKS 
sees more data per day than all of 
PINWALE 
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